Skip to content
Heist/ feed
Back to feed
High

Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

Type: advisorySources: OSV

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-31028
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 02:02 UTC · Revision 1

Source evidence

Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

core-osv · Original source

Published 3 Jun 2022, 14:40 UTC

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.

osv:CVE-2022-31028
Complete source record
{
  "id": "95e1ce254d60abb32387230fb509ca3bd77b23513b986f2e7716b7e1dc972bfd",
  "url": "https://osv.dev/vulnerability/CVE-2022-31028",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO",
    "summary": "MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.",
    "evidence": "osv:CVE-2022-31028",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2022-31028",
      "aliases": [
        "CVE-2022-31028",
        "GHSA-qrpr-r3pw-f636"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/minio/minio",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c8fbc943295af9caf51a9441a0b046c72a5a3f56"
                },
                {
                  "fixed": "be6ccd129d3e759abaaeb326d9371aa769348771"
                },
                {
                  "fixed": "61a7434379164c0a2150db8047343e9ec769ae91"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "2019-09-25t18-25-51z"
                      },
                      {
                        "fixed": "2022-06-02t02-11-04z"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "61a7434379164c0a2150db8047343e9ec769ae91"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "RELEASE.2022-06-03T01-40-53Z"
                  }
                ]
              }
            }
          ],
          "versions": [
            "RELEASE.2022-05-26T05-48-41Z",
            "RELEASE.2022-05-23T18-45-11Z",
            "RELEASE.2022-05-19T18-20-59Z",
            "RELEASE.2022-05-08T23-50-31Z",
            "RELEASE.2022-05-04T07-45-27Z",
            "RELEASE.2022-05-03T20-36-08Z",
            "RELEASE.2022-04-30T22-23-53Z",
            "RELEASE.2022-04-29T01-27-09Z",
            "RELEASE.2022-04-26T01-20-24Z",
            "RELEASE.2022-04-16T04-26-02Z",
            "RELEASE.2022-04-12T06-55-35Z",
            "RELEASE.2022-04-09T15-09-52Z",
            "RELEASE.2022-04-08T19-44-35Z",
            "RELEASE.2022-04-01T03-41-39Z",
            "RELEASE.2022-03-26T06-49-28Z",
            "RELEASE.2022-03-24T00-43-44Z",
            "RELEASE.2022-03-22T02-05-10Z",
            "RELEASE.2022-03-17T06-34-49Z",
            "RELEASE.2022-03-17T02-57-36Z",
            "RELEASE.2022-03-14T18-25-24Z",
            "RELEASE.2022-03-11T23-57-45Z",
            "RELEASE.2022-03-11T11-08-23Z",
            "RELEASE.2022-03-08T22-28-51Z",
            "RELEASE.2022-03-05T06-32-39Z",
            "RELEASE.2022-03-03T21-21-16Z",
            "RELEASE.2022-02-26T02-54-46Z",
            "RELEASE.2022-02-24T22-12-01Z",
            "RELEASE.2022-02-18T01-50-10Z",
            "RELEASE.2022-02-17T23-22-26Z",
            "RELEASE.2022-02-16T00-35-27Z",
            "RELEASE.2022-02-12T00-51-25Z",
            "RELEASE.2022-02-07T08-17-33Z",
            "RELEASE.2022-02-05T04-40-59Z",
            "RELEASE.2022-02-01T18-00-14Z",
            "RELEASE.2022-01-28T02-28-16Z",
            "RELEASE.2022-01-27T03-53-02Z",
            "RELEASE.2022-01-25T19-56-04Z",
            "RELEASE.2022-01-08T03-11-54Z",
            "RELEASE.2022-01-07T01-53-23Z",
            "RELEASE.2022-01-04T07-41-07Z",
            "RELEASE.2022-01-03T18-22-58Z",
            "RELEASE.2021-12-29T06-49-06Z",
            "RELEASE.2021-12-27T07-23-18Z",
            "RELEASE.2021-12-20T22-07-16Z",
            "RELEASE.2021-12-18T04-42-33Z",
            "RELEASE.2021-12-10T23-03-39Z",
            "RELEASE.2021-12-09T06-19-41Z",
            "RELEASE.2021-11-24T23-19-33Z",
            "RELEASE.2021-11-09T03-21-45Z",
            "RELEASE.2021-11-05T09-16-26Z",
            "RELEASE.2021-11-03T03-36-36Z",
            "RELEASE.2021-10-27T16-29-42Z",
            "RELEASE.2021-10-23T03-28-24Z",
            "RELEASE.2021-10-13T00-23-17Z",
            "RELEASE.2021-10-10T16-53-30Z",
            "RELEASE.2021-10-08T23-58-24Z",
            "RELEASE.2021-10-06T23-36-31Z",
            "RELEASE.2021-10-02T16-31-05Z",
            "RELEASE.2021-09-24T00-24-24Z",
            "RELEASE.2021-09-23T04-46-24Z",
            "RELEASE.2021-09-18T18-09-59Z",
            "RELEASE.2021-09-15T04-54-25Z",
            "RELEASE.2021-09-09T21-37-07Z",
            "RELEASE.2021-09-03T03-56-13Z",
            "RELEASE.2021-08-31T05-46-54Z",
            "RELEASE.2021-08-25T00-41-18Z",
            "RELEASE.2021-08-20T18-32-01Z",
            "RELEASE.2021-08-17T20-53-08Z",
            "RELEASE.2021-08-05T22-01-19Z",
            "RELEASE.2021-07-30T00-02-00Z",
            "RELEASE.2021-07-27T02-40-15Z",
            "RELEASE.2021-07-22T05-23-32Z",
            "RELEASE.2021-07-21T22-15-23Z",
            "RELEASE.2021-07-15T22-27-34Z",
            "RELEASE.2021-07-12T02-44-53Z",
            "RELEASE.2021-07-08T19-43-25Z",
            "RELEASE.2021-07-08T01-15-01Z",
            "RELEASE.2021-06-17T00-10-46Z",
            "RELEASE.2021-06-14T01-29-23Z",
            "RELEASE.2021-06-09T18-51-39Z",
            "RELEASE.2021-06-07T21-40-51Z",
            "RELEASE.2021-05-27T22-06-31Z",
            "RELEASE.2021-05-26T00-22-46Z",
            "RELEASE.2021-05-22T02-34-39Z",
            "RELEASE.2021-05-20T22-31-44Z",
            "RELEASE.2021-05-18T00-53-28Z",
            "RELEASE.2021-05-16T05-32-34Z",
            "RELEASE.2021-05-11T23-27-41Z",
            "RELEASE.2021-04-22T15-44-28Z",
            "RELEASE.2021-04-18T19-26-29Z",
            "RELEASE.2021-03-26T00-00-41Z",
            "RELEASE.2021-03-17T02-33-02Z",
            "RELEASE.2021-03-12T00-00-47Z",
            "RELEASE.2021-03-10T05-11-33Z",
            "RELEASE.2021-03-04T00-53-13Z",
            "RELEASE.2021-03-01T04-20-55Z",
            "RELEASE.2021-02-24T18-44-45Z",
            "RELEASE.2021-02-23T20-05-01Z",
            "RELEASE.2021-02-19T04-38-02Z",
            "RELEASE.2021-02-14T04-01-33Z",
            "RELEASE.2021-02-11T08-23-43Z",
            "RELEASE.2021-02-07T01-31-02Z",
            "RELEASE.2021-02-01T22-56-52Z",
            "RELEASE.2021-01-30T00-20-58Z",
            "RELEASE.2021-01-16T02-19-44Z",
            "RELEASE.2021-01-08T21-18-21Z",
            "RELEASE.2021-01-05T05-22-38Z",
            "RELEASE.2020-12-29T23-29-29Z",
            "RELEASE.2020-12-26T01-35-54Z",
            "RELEASE.2020-12-23T02-24-12Z",
            "RELEASE.2020-12-18T03-27-42Z",
            "RELEASE.2020-12-16T05-05-17Z",
            "RELEASE.2020-12-12T08-39-07Z",
            "RELEASE.2020-12-10T01-54-29Z",
            "RELEASE.2020-12-03T05-49-24Z",
            "RELEASE.2020-12-03T00-03-10Z",
            "RELEASE.2020-11-25T22-36-25Z",
            "RELEASE.2020-11-19T23-48-16Z",
            "RELEASE.2020-11-13T20-10-18Z",
            "RELEASE.2020-11-12T22-33-34Z",
            "RELEASE.2020-11-10T21-02-24Z",
            "RELEASE.2020-11-06T23-17-07Z",
            "RELEASE.2020-10-28T08-16-50Z",
            "RELEASE.2020-10-27T04-03-55Z",
            "RELEASE.2020-10-18T21-54-12Z",
            "RELEASE.2020-10-12T21-53-21Z",
            "RELEASE.2020-10-09T22-55-05Z",
            "RELEASE.2020-10-03T02-19-42Z",
            "RELEASE.2020-09-26T03-44-56Z",
            "RELEASE.2020-09-23T19-18-30Z",
            "RELEASE.2020-09-21T22-31-59Z",
            "RELEASE.2020-09-17T04-49-20Z",
            "RELEASE.2020-09-16T04-22-35Z",
            "RELEASE.2020-09-10T22-02-45Z",
            "RELEASE.2020-09-08T23-05-18Z",
            "RELEASE.2020-09-05T07-14-49Z",
            "RELEASE.2020-09-02T18-19-50Z",
            "RELEASE.2020-08-27T05-16-20Z",
            "RELEASE.2020-08-26T00-00-49Z",
            "RELEASE.2020-08-25T00-21-20Z",
            "RELEASE.2020-08-18T19-41-00Z",
            "RELEASE.2020-08-16T18-39-38Z",
            "RELEASE.2020-08-13T02-39-50Z",
            "RELEASE.2020-08-08T04-50-06Z",
            "RELEASE.2020-08-07T01-23-07Z",
            "RELEASE.2020-08-05T21-34-13Z",
            "RELEASE.2020-08-04T23-10-51Z",
            "RELEASE.2020-07-31T03-39-05Z",
            "RELEASE.2020-07-27T18-37-02Z",
            "RELEASE.2020-07-24T22-43-05Z",
            "RELEASE.2020-07-22T00-26-33Z",
            "RELEASE.2020-07-20T02-25-16Z",
            "RELEASE.2020-07-18T18-48-16Z",
            "RELEASE.2020-07-14T19-14-30Z",
            "RELEASE.2020-07-13T18-09-56Z",
            "RELEASE.2020-07-12T19-14-17Z",
            "RELEASE.2020-07-11T21-14-23Z",
            "RELEASE.2020-07-11T06-07-16Z",
            "RELEASE.2020-06-12T00-06-19Z",
            "RELEASE.2020-06-03T22-13-49Z",
            "RELEASE.2020-06-01T17-28-03Z",
            "RELEASE.2020-05-29T14-08-49Z",
            "RELEASE.2020-05-28T23-29-21Z",
            "RELEASE.2020-05-16T01-33-21Z",
            "RELEASE.2020-05-08T02-40-49Z",
            "RELEASE.2020-05-06T23-23-25Z",
            "RELEASE.2020-05-01T22-19-14Z",
            "RELEASE.2020-04-28T23-56-56Z",
            "RELEASE.2020-04-23T00-58-49Z",
            "RELEASE.2020-04-22T00-11-12Z",
            "RELEASE.2020-04-15T19-42-18Z",
            "RELEASE.2020-04-15T00-39-01Z",
            "RELEASE.2020-04-10T03-34-42Z",
            "RELEASE.2020-04-04T05-39-31Z",
            "RELEASE.2020-04-02T21-34-49Z",
            "RELEASE.2020-03-25T07-03-04Z",
            "RELEASE.2020-03-19T21-49-00Z",
            "RELEASE.2020-03-14T02-21-58Z",
            "RELEASE.2020-03-09T18-26-53Z",
            "RELEASE.2020-03-06T22-23-56Z",
            "RELEASE.2020-03-05T01-04-19Z",
            "RELEASE.2020-02-27T00-23-05Z",
            "RELEASE.2020-02-20T22-51-23Z",
            "RELEASE.2020-02-07T23-28-16Z",
            "RELEASE.2020-02-07T04-56-50Z",
            "RELEASE.2020-01-25T02-50-51Z",
            "RELEASE.2020-01-16T22-40-29Z",
            "RELEASE.2020-01-16T03-05-44Z",
            "RELEASE.2020-01-03T19-12-21Z",
            "RELEASE.2019-12-30T05-45-39Z",
            "RELEASE.2019-12-24T23-04-45Z",
            "RELEASE.2019-12-19T22-52-26Z",
            "RELEASE.2019-12-17T23-16-33Z",
            "RELEASE.2019-10-12T01-39-57Z",
            "RELEASE.2019-10-11T00-38-09Z",
            "RELEASE.2019-10-02T21-19-38Z",
            "RELEASE.2019-09-26T19-42-35Z",
            "RELEASE.2019-09-25T18-25-51Z"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31028.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:45.980513212Z",
      "provider": "osv",
      "references": [
        "https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1",
        "https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53Z",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31028.json",
        "https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-31028",
        "https://github.com/minio/minio/pull/14995"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31028.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-31028",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514102,
  "published_at": "2022-06-03T14:40:11+00:00"
}